InsightsCase Studies
Forensic InvestigationsExecution Mandate

Forensic Audit of an Infrastructure and Civil Construction Borrower

Establishing where project funds went in a sector built to make that question difficult to answer

By Ashish Chaudhary•September 2026•6 MIN READ
Client & Engagement
Project financed borrower with multiple concurrent contracts and layered subcontracting, examined under lender-directed forensic mandate
Industry Sector
Infrastructure and Civil Construction
Jurisdiction & Geography
India
Practice Leadership
Forensic Audit & Investigations
Mandate Performance Metrics
Contract ScopeMulti-projectConcurrent contracts examined
Fund Flow TracingEnd to EndReconstruction across entities
Irregularity Categories4Tested for across the engagement
Referencing StandardDocument LevelApplied to every finding

Executive Mandate Summary

A lender directed a forensic examination of an infrastructure and civil construction borrower after concerns arose about the application of project funds and the substance of certain counterparties. Construction accounts are structurally the hardest class of forensic work: percentage of completion accounting, mobilisation advances, layered subcontracting and work in progress all legitimately absorb cash, and each provides cover for movement that is not what it appears. The engagement established counterparty substance before tracing value, reconstructed fund flows past the first recipient across project accounts and group entities, and delivered graded findings distinguishing sectoral stress from diversion on the evidence.

Key Transaction & Governance Challenges

  • •
    Percentage of completion accounting makes reported performance a function of judgment rather than transactions. Mobilisation advances move material sums before any physical progress exists to verify against. Genuine sector practice and concealment produce similar-looking ledgers.
  • •
    Three or four entities may sit between the borrower and the work actually performed. Each layer is separately documented, and each adds distance between the lender's money and verifiable execution.
  • •
    WIP and retention balances absorb cash without producing an asset anyone can see or inspect within a forensic timeline. Project sites are dispersed, limiting physical verification.
  • •
    The distinction between legitimate sector mechanics and their misuse must be established through counterparty substance rather than through documentation, because the documentation is nearly always correct on the surface.
  • •
    The first movement of funds is nearly always documented correctly, because it is the one that gets inspected. Findings come from the second and third legs, which requires reconstructing the entire chain rather than sampling it.

Northrop Execution Architecture & Methodology

1
Project population identified, material contracts and counterparties selected for examination, information request issued, independence and conflict check documented. Effort concentrated on where value could have left.
2
Group entities, subcontractors, suppliers and connected counterparties mapped through registry, directorship, address and shareholding analysis. Counterparty identity established independently from public records before any borrower interaction.
3
Project account fund flow reconstruction, mobilisation advance tracing, subcontractor payment analysis. Funds traced beyond the first recipient, because the first leg is almost always documented correctly and findings come from the second and third legs.
4
Findings graded by evidentiary strength, management queries issued and assessed. Forensic report distinguishing sectoral stress from diversion on the evidence, drafted in lender format and independently reviewed before release.

The question behind the mandate

When mobilisation advances, subcontractor payments and work in progress can all legitimately absorb funds, how do you establish which movements were real?

Construction accounts are structurally the hardest class of forensic work in India. Percentage of completion accounting means reported revenue rests on judgment rather than invoicing. Mobilisation advances move large sums early, before there is anything to inspect. Subcontracting layers place three or four entities between the borrower and the work actually performed. Each of these is a legitimate feature of how the sector operates, and each provides cover for movement that is not what it appears to be. The examination therefore could not rely on document sufficiency. It relied on establishing whether the entities receiving project funds had the capacity to perform the work attributed to them, and on tracing what happened to those funds after receipt.

The analytical spine

Four workstreams carried the examination, structured so that each tested the explanations produced by the others.

Disbursements were traced to the project accounts for which they were sanctioned, and application tested against project requirements at the relevant stage of execution. Cross-project application was identified and quantified, because it converts a project-financed exposure into an unsecured group exposure without the lender being informed. Material subcontractors were tested for capacity: incorporation history, filed financials, employee and equipment indicators, registration status, and whether the entity transacted with anyone other than the borrower group. Mobilisation advances were traced from release through onward movement, past the first recipient, since advances are released against guarantees rather than progress, making them the earliest opportunity for value to leave a project. Fund movement between the borrower, group entities and counterparties was reconstructed to identify circularity, which is invisible at transaction level and becomes apparent only when the chain is assembled and timing compared.

What made the difference

Three disciplines separated this engagement from forensic work that lenders discount.

First, substance before value. Establishing who the counterparties actually were preceded analysis of how much they were paid. In construction, a modest payment to an entity that cannot have performed the work is more probative than a large payment to one that plainly did.

Second, tracing past the first leg. The first movement of funds is nearly always documented correctly, because it is the one that gets inspected. Findings in this sector come from the second and third legs, and reaching them requires reconstructing the chain rather than sampling it.

Third, sector literacy. Mobilisation advances, retention, work in progress and percentage of completion are legitimate mechanics, not red flags in themselves. Treating them as suspicious produces reports that lenders discount. The examination distinguished the mechanics from their misuse.

Consider this work if you are facing

Project-financed exposure where funds may have been applied outside the sanctioned project. Subcontractors that appear only in the borrower's records and transact with no one else. Mobilisation advances released against guarantees where subsequent progress is not evident. Group structures where projects, sponsors and contracting entities are separately held. Work in progress or retention balances that have grown without corresponding execution. Stress in a construction account where it is unclear whether the cause is sectoral or internal. A consortium requiring an evidenced position before a classification decision.

Verifiable Institutional Outcomes & Value Realized

  • Project-level fund application tested against sanctioned purpose. Cross-project fund movement identified and quantified, exposing where a project-financed exposure had been converted into an unsecured group exposure without lender knowledge.
  • Material subcontractors assessed for capacity to perform the work attributed to them: incorporation history, filed financials, employee and equipment indicators, and whether the entity transacted with any party other than the borrower group.
  • Where the record supported the borrower's explanation, that was stated plainly. In a sector where stress is frequently genuine and sector-wide, a forensic report that makes this distinction is more valuable than one that treats every anomaly as suspicious.
  • Findings graded by evidentiary strength and referenced to the primary document supporting them, so the lender could act on the report rather than merely note it.
Ashish Chaudhary

Ashish Chaudhary

Founder and Managing Director
Private Mandate Advisory Desk

Facing a Similar High-Stakes Transaction or Turnaround?

Northrop partners execute buy-side due diligence, fraud forensics, and financial restructuring with strict board confidentiality and unmatched technical rigor across Indian jurisdictions.

Next Documented MandateManagement Consulting

Case Study: Ghost Trainees and Unverified Placements in a Skill Development NGO

A skill development NGO reported that 1,200 youth had been trained and 840 placed in jobs under a programme funded through a ₹1.4 crore CSR contribution. The reported 70% placement rate prompted an independent review of beneficiary records, training delivery, placement claims and programme expenditure. Northrop Management Private Limited conducted a forensic verification covering beneficiary deduplication, attendance records, direct beneficiary calls, employer confirmations, offer letters, salary claims and the underlying financial trail.

View Full Mandate Record